Description
Where Anyone links are allowed (an exception to CB-M365-COLLAB-003, for the tenant, a site or a OneDrive), they are constrained:
- they expire after at most
{{ anyone_link_max_days }}days (RequireAnonymousLinksExpireInDays); - they only give View permission, for files and for folders (
FileAnonymousLinkTypeandFolderAnonymousLinkType=View).
If neither SharePoint nor OneDrive allows Anyone links, the control is met.
Rationale
An Anyone link is a bearer credential. An expiry date bounds how long a leaked or forgotten link exposes the content. View-only stops unauthenticated people from altering documents, replacing them with malicious files, or using an upload folder to plant content in the tenant.
Impact
Users must recreate links after expiry. A shorter expiry also shortens existing links when the new value is lower. File requests and View, edit, and upload folder links stop working.
Parameters
| Parameter | Baseline | Hardened | Bounds |
|---|---|---|---|
anyone_link_max_daysinteger, days. Maximum lifetime of an Anyone link. | 30 | 30 | 1 to 730 |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
- Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
- Browse to Policies > Sharing. If both sliders are below Anyone, the control is met.
- Otherwise, under Choose expiration and permissions options for Anyone links, check that
These links must expire within this many days is selected with at most
{{ anyone_link_max_days }}, and that These links can give these permissions is View for Files and Folders. - With the SharePoint Online Management Shell (SharePoint Administrator):
Get-SPOTenant | Select-Object SharingCapability, OneDriveSharingCapability, RequireAnonymousLinksExpireInDays, FileAnonymousLinkType, FolderAnonymousLinkType. - Fail if Anyone links are allowed and
RequireAnonymousLinksExpireInDaysis0or greater than{{ anyone_link_max_days }}, or if either link type is notView.
Remediation
- In the SharePoint admin center, browse to Policies > Sharing > Choose expiration and permissions options for Anyone links.
- Select These links must expire within this many days and enter
{{ anyone_link_max_days }}or less. - Set Files and Folders to View. Select Save. Role: SharePoint Administrator.
- PowerShell equivalent:
Set-SPOTenant -RequireAnonymousLinksExpireInDays {{ anyone_link_max_days }} -FileAnonymousLinkType View -FolderAnonymousLinkType View.
References
- Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
- External sharing overview Microsoft, vendor-doc, accessed 2026-10-24
- Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
- CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24
Mappings
| Framework | ID | Relation |
|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-3 | related |
| NIST SP 800-53 Rev. 55.1.1 | AC-22 | related |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.SHAREPOINT.3.1v1 | equivalent |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.SHAREPOINT.3.2v1 | equivalent |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1530 |
Related controls
- related
CB-M365-COLLAB-003Restrict SharePoint external sharing to authenticated guests - related
CB-M365-COLLAB-004Restrict OneDrive external sharing to authenticated guests
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
